[Solved] Basic virtual network with VMs to get internet

[Pipeng]

Hi all!, I'm new in all this about network, as a linux user I knows some basics, but I lack a of knowledge, actually the idea rn is not about where to learn, but a way for a basic user to be able to get working some basic network for VMs.

To fully understand how will works the solutions... we can get to know a lot of things, I have done some research, the main point is, we can create several VMs, but they are usually on NAT, so we can't access them from the host, the point is be able to create a network, connect the VMs and be able to access to them.

Reading, seems the best option is use a bridge (which seems to be very similar to a virtual switch), most of docs describe how to perform this, but there is a tricky part, the docs uses ehternet interface to do it to works, so there is some problems

If we don't have a ethernet connection we will can't route the devices, so no ip will be assigned to any place.
Does not works for Wifi.
We need to use a physical device, which is far from ideal.

Rn in my limitated experience, seems the point is create a bridge, create a virtual device, give internet to it, put the bridge as master to give internet to the bridge, and then use that network on the VMs.

How I'm trying to do it without ethernet (a dummy interface just does not does the trick on the bridge), is hard to test the actal info, there is some good videos and docs like https://www.youtube.com/watch?v=6435eNKpyYw&t=1234s

So here the points, is bridge the best solution? (best not easier), How can we create this network?

In the previous video, here is the used config for a bridge using ethernet, how can we change/update it using a virtual one:

/etc/systemd/network/br.netdev

[salahx]

Some of the extensions are wrong. 1-br0-bind.netdev and 2-br0-dhcp.netdev should end in .network, not .netdev.

[Pipeng]

Hi yes, sorry I wrote them wrong on the post, they are using the right names.

Still the files are a example using a physical interface, instead a virtual one to achieve this.

[salahx]

I don;'t think wifi support bridging. The problem is the MAC (BSSID) address is part of the wifi association, so its not possible to carry "foreign" MACs over it .You have to use a routed network. If you libvirt, it has optional firewalld integration for help with poking holes in the NAT.

[Pipeng]

Yes, we can't use wifi, that is why I thought in a virtual interface isntead, I tryied it but didn't worked, how we can do what you suggests?

[salahx]

If you are using libvirt, it already creates a 192.168.122.0/24 NAT network for you, along with an interface: virbr0. IF you also use virt-manager you can delete it and create a new one Edit->Connection Details->Virtual Networks.

You have 2 choices: either routing with NAT (called "nat" in libvirt) , or routing without NAT (called "routed" in libvirt). In NAT mode, all traffic appears to come from the VM host. In route mode, traffic appears to come from a different network. In both cases, no configuration is necessary via systemd-networkd: libvirt will manage the interface on its own.

[Pipeng]

Hi, yes, the main issue with the default configurations is that we can't reach them from the host, which is one of the points of the post.

[salahx]

How exactly are you trying to reach them? You won't be able to directly reach NAT'ed guests from the outside without forwarding rules, but routed guests should be reachable normally.

Fist, shut down all virtual machines.

If you want to use a routed network, use a file like this one:

local.xml:

[Pipeng]

Hi! thx for the help.

Sadly there is some issues... from the VMs... I don't have access to internet, I try a ubuntu iso and seems I got an ip from what the ui shows, but ip link list does not agree with it, shows no ip.

[salahx]

That's normal. You won't see the IP from the "outside". Only the "inside" adapter sees the IP.

If you don;t have access to the Internet from your guests, make sure IP Forwarding is enabled on the host.

[Pipeng]

Hi, the adapter I post is from the VM, they are not getting an ip.

How can I check the forwading is enabled?

thx.

[salahx]

Ok, the guests should be getting DHCP leases from the host, and the in-guest network adapters should have IP addresses. IF it doesn't, it could be one of 2 things: either there's something wrong with libvirt's network configuration, or the client is stuck on it old IP address.

Fir the first case, execute

[Pipeng]

Hi!

I can confirm virsh is using the right network (is not active by default, by I start it manually from the gui before create the VM), and forwading is active.

About the vms:

[salahx]

OK, its looks different on mine because mine is Ethernet and bridged. Your looks correct for a routed network. The guests should be getting IP address from the host's dnsmasq (which by started by libvirtd). Is it still not working?

IF its still not working and you haven't already done it, shut down libvirtd, make sure dnsmasq is not running, then restart libvirtd and see if your guests can get IP's after that.

[Pipeng]

Hi, still does not works.

I have not enabled dnsmasq service.
Libvirt is using dnsmasq to assign ip, even in the logs we can see it already assigned an ip to the guest:

[salahx]

ok, check a few things:

From the guest, ping:

The host
Another device on the LAN
Your router
An Internet host

See which one succeed and which ones fail.

[Pipeng]

Hi, here the results:

Host Ip: 192.168.5.130 (Ok)
Host Lan: 192.168.5.22 (100% packet lost)
Host Router: 192.168.5.1 (Destination Host Unreachable)

Guest Ip: 192.168.123.253
Guest router (?: 192.168.123.1 (Ok)

Ping to google: 100% packet lost

[salahx]

Ok so it looks like packets are correct being routed off the host,, but they can't get back.

In your router, try adding a static route. You want to route everything to the 192.168.123.0/24 network to your VM's host address (192.168.5.130) in your case.

[Pipeng]

Is there a way to achieve that locally? The router belongs to the internet company, I don't have access to it.

[salahx]

That's a problem. Without a route, you can get packets out, but when they come into the router, the router will send them to its default gateway (the ISP) rather then your network. In addition the router may have a firewall that prevent anything not in its network (192.168.5.024) is rejected on the internal interfaces.

The only way top make it work transparently to other hosts is through NAT or bridging. Routing required control of the main router. The mainrouter also needs to send ICMP REDIRECT packets to the internal hosts telling them how to find the guest network (most will do this if the have a static route), otherwise a route will need to be added to all clients on the networks in addition to the guest network.

[Pipeng]

Which one could we try? the default NAT has the guest hide, while bridging, should be done with a virtual interface instead of a physical one, even if I know it, I does not know how to configure it.

[Hu]

NAT is generally easier to set up. When set up properly, the host can connect to the guests without issue. Other physical machines will need to connect to the host and let a NAT rule on the host pass the traffic to the guest.

[Pipeng]

how can we configure it? can you guide me plis? thx!

[salahx]

If you still have the default network, we need to re-enable it:

[Pipeng]

Hi, thx, and how can we do the host access to the guest with NAT? Hu said is possible to do.